Top 10 winner

CRIME

Dennis Fisher · threatpost.com

Threatpost's pre-disclosure report on CRIME: Rizzo and Duong found an optional TLS feature that leaks enough about encrypted traffic to recover session cookies, in every TLS version including 1.2 and whatever the cipher suite. With a man-in-the-middle position and JavaScript in the victim's browser they decrypt cookies; the RC4 switch that stopped BEAST does not help.

Record

Researcher

Dennis Fisher

Published by

threatpost.com

In the archive

• Ranked #1 in the 2012 Top 10 Web Hacking Techniques

Related sources

• Crack in Internet's foundation of trust allows HTTPS session hijacking
• Earlier compression side-channel research

Tags

• tls
• https
• side-channel
• cookie
• info-leak
• owasp-a02-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Dennis Fisher, first published at the original source. Preserved copies are kept so the citation survives its host.